General

  • Target

    SCAN_20210113140930669.exe

  • Size

    1.0MB

  • Sample

    210113-v3abmdnzy2

  • MD5

    5f7d0bc54b8cfbfca3057aeddb3c0909

  • SHA1

    a426832c6b424a035cfb30f9d4ba07cd45dc5ce1

  • SHA256

    2120a958805532d53821fb90eaaa140d8a6461f667b392e352311ff896465f46

  • SHA512

    74977c2c7ac0793912dbc073cb7dc6184d42cab8d93e595abe673c65402b439e0adbaf2e82686dd11da79e4b6dc6d75e94a2745fe7c2e8fd1f2fd55de5b9082b

Malware Config

Extracted

Family

formbook

C2

http://www.midnightblueinc.com/2kf/

Decoy

edmondscakes.com

doublewldr.online

tickets2usa.com

heyhxry.com

weightloss-gulfport.com

prosselius.com

newviewroofers.com

jacksonarearealestate.com

catparkas.xyz

pagos2020.com

sonwsefjrahi.online

franchisethings.com

nuocvietngaynay.com

sohelvai.com

mikeyroush.com

lamesaroofing.com

betbigo138.com

amazon-service-recovery.com

clockin.net

riostrader.com

Targets

    • Target

      SCAN_20210113140930669.exe

    • Size

      1.0MB

    • MD5

      5f7d0bc54b8cfbfca3057aeddb3c0909

    • SHA1

      a426832c6b424a035cfb30f9d4ba07cd45dc5ce1

    • SHA256

      2120a958805532d53821fb90eaaa140d8a6461f667b392e352311ff896465f46

    • SHA512

      74977c2c7ac0793912dbc073cb7dc6184d42cab8d93e595abe673c65402b439e0adbaf2e82686dd11da79e4b6dc6d75e94a2745fe7c2e8fd1f2fd55de5b9082b

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks